0x80090010 is NTE_PERM — "Access denied" from the Windows cryptographic subsystem (CNG).
During SCEP enrolment it means the client could not create or use the private key: the key
storage provider refused the operation. This is a local device problem, not a network or
server problem.
0x80090010
NTE_PERM: access denied on the key
What it means
Common causes
The TPM is in a state where key operations are refused (lockout, pending clear, stale owner authorisation).
Broken ACLs on the machine key folders (
%ProgramData%\Microsoft\Crypto), often after aggressive 'hardening' scripts or folder permission changes.Security software blocking key-container access.
How to fix it
Check TPM health in
tpm.msc(orGet-Tpmin PowerShell) — status should be ready with no pending operations. Update TPM firmware if the vendor has a known-issue advisory.If the TPM is wedged and the device has no data protected by it that you cannot recover, clear the TPM from tpm.msc — note this destroys TPM-protected keys, so suspend BitLocker and plan for Windows Hello re-registration first.
Verify NTFS permissions on
%ProgramData%\Microsoft\Cryptohave not been customised; compare with a healthy device.Temporarily exclude the crypto folders from third-party endpoint protection to rule it out.